Skip to content

Commit b9f8dc2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-25hw-9r4r-54w4 GHSA-2j9m-25xv-mp6r GHSA-4463-8rvf-rj9f GHSA-gc77-jrv9-6fjp GHSA-jhg5-9w7p-xm6m GHSA-mhmx-mjv6-w337 GHSA-pmgp-q838-fh9g GHSA-v632-2m87-7469
1 parent 66ea40c commit b9f8dc2

8 files changed

Lines changed: 317 additions & 1 deletion

File tree

‎advisories/unreviewed/2026/05/GHSA-25hw-9r4r-54w4/GHSA-25hw-9r4r-54w4.json‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-25hw-9r4r-54w4",
4+
"modified": "2026-05-09T03:31:22Z",
5+
"published": "2026-05-09T03:31:22Z",
6+
"aliases": [
7+
"CVE-2026-7652"
8+
],
9+
"details": "The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthenticated guest booking flow in versions up to, and including, 5.5.0 This is due to the save_connected_wordpress_user() function propagating a LatePoint customer's email address to its linked WordPress user account via wp_update_user() without any ownership verification, combined with the guest booking flow's ability to overwrite an existing customer's email through phone-based merge without authentication. This makes it possible for unauthenticated attackers to overwrite the email address of a non-super-admin WordPress user account that is not yet linked to a LatePoint customer, enabling full account takeover by subsequently triggering the standard WordPress password-reset flow to the attacker-controlled address granted the plugin is configured with WordPress user integration enabled, phone-based contact merging, and customer authentication disabled. Administrator accounts on single-site installs are not affected.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7652"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/latepoint.php#L1165"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/customer_helper.php#L238"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php#L1940"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.2/lib/helpers/steps_helper.php#L1972"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/latepoint.php#L1165"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/customer_helper.php#L238"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/steps_helper.php#L1940"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/steps_helper.php#L1972"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/latepoint.php#L1165"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/customer_helper.php#L238"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/steps_helper.php#L1940"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/steps_helper.php#L1972"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://plugins.trac.wordpress.org/changeset/3522933/latepoint/trunk/latepoint.php"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Flatepoint/tags/5.5.0&new_path=%2Flatepoint/tags/5.5.1"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bdaa32cd-a148-4554-9fd5-f5b0a5b2d1c3?source=cve"
81+
}
82+
],
83+
"database_specific": {
84+
"cwe_ids": [
85+
"CWE-640"
86+
],
87+
"severity": "MODERATE",
88+
"github_reviewed": false,
89+
"github_reviewed_at": null,
90+
"nvd_published_at": "2026-05-09T03:16:15Z"
91+
}
92+
}

‎advisories/unreviewed/2026/05/GHSA-2j9m-25xv-mp6r/GHSA-2j9m-25xv-mp6r.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2j9m-25xv-mp6r",
4-
"modified": "2026-05-08T21:31:24Z",
4+
"modified": "2026-05-09T03:31:21Z",
55
"published": "2026-05-08T15:31:21Z",
66
"aliases": [
77
"CVE-2026-39816"
@@ -27,6 +27,10 @@
2727
"type": "WEB",
2828
"url": "https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb"
2929
},
30+
{
31+
"type": "WEB",
32+
"url": "https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce"
33+
},
3034
{
3135
"type": "WEB",
3236
"url": "http://www.openwall.com/lists/oss-security/2026/04/13/8"

‎advisories/unreviewed/2026/05/GHSA-4463-8rvf-rj9f/GHSA-4463-8rvf-rj9f.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4463-8rvf-rj9f",
4+
"modified": "2026-05-09T03:31:22Z",
5+
"published": "2026-05-09T03:31:22Z",
6+
"aliases": [
7+
"CVE-2026-6666"
8+
],
9+
"details": "A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6666"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pgbouncer.org/changelog.html#pgbouncer-125x"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-476"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-09T01:16:09Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-gc77-jrv9-6fjp/GHSA-gc77-jrv9-6fjp.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gc77-jrv9-6fjp",
4+
"modified": "2026-05-09T03:31:22Z",
5+
"published": "2026-05-09T03:31:22Z",
6+
"aliases": [
7+
"CVE-2026-6667"
8+
],
9+
"details": "PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6667"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pgbouncer.org/changelog.html#pgbouncer-125x"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-862"
30+
],
31+
"severity": "MODERATE",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-09T01:16:09Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-jhg5-9w7p-xm6m/GHSA-jhg5-9w7p-xm6m.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jhg5-9w7p-xm6m",
4+
"modified": "2026-05-09T03:31:22Z",
5+
"published": "2026-05-09T03:31:22Z",
6+
"aliases": [
7+
"CVE-2026-8207"
8+
],
9+
"details": "Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature. Successful exploitation requires Teacher or higher privileges. Exploitation could result in unintended read/write activities to the underlying database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V4",
13+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8207"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://github.com/GibbonEdu/core/releases/tag/v30.0.01"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#sql-injectiongetting-warmed-up"
29+
}
30+
],
31+
"database_specific": {
32+
"cwe_ids": [
33+
"CWE-89"
34+
],
35+
"severity": "HIGH",
36+
"github_reviewed": false,
37+
"github_reviewed_at": null,
38+
"nvd_published_at": "2026-05-09T03:16:16Z"
39+
}
40+
}

‎advisories/unreviewed/2026/05/GHSA-mhmx-mjv6-w337/GHSA-mhmx-mjv6-w337.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mhmx-mjv6-w337",
4+
"modified": "2026-05-09T03:31:21Z",
5+
"published": "2026-05-09T03:31:21Z",
6+
"aliases": [
7+
"CVE-2026-6665"
8+
],
9+
"details": "The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6665"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pgbouncer.org/changelog.html#pgbouncer-125x"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-121"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-09T01:16:09Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-pmgp-q838-fh9g/GHSA-pmgp-q838-fh9g.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pmgp-q838-fh9g",
4+
"modified": "2026-05-09T03:31:21Z",
5+
"published": "2026-05-09T03:31:21Z",
6+
"aliases": [
7+
"CVE-2026-6664"
8+
],
9+
"details": "An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6664"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://www.pgbouncer.org/changelog.html#pgbouncer-125x"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-190"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-09T01:16:08Z"
35+
}
36+
}

‎advisories/unreviewed/2026/05/GHSA-v632-2m87-7469/GHSA-v632-2m87-7469.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v632-2m87-7469",
4+
"modified": "2026-05-09T03:31:21Z",
5+
"published": "2026-05-09T03:31:21Z",
6+
"aliases": [
7+
"CVE-2026-41705"
8+
],
9+
"details": "Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs.\nSpring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
14+
}
15+
],
16+
"affected": [],
17+
"references": [
18+
{
19+
"type": "ADVISORY",
20+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41705"
21+
},
22+
{
23+
"type": "WEB",
24+
"url": "https://spring.io/security/cve-2026-41705"
25+
}
26+
],
27+
"database_specific": {
28+
"cwe_ids": [
29+
"CWE-917"
30+
],
31+
"severity": "HIGH",
32+
"github_reviewed": false,
33+
"github_reviewed_at": null,
34+
"nvd_published_at": "2026-05-09T01:16:08Z"
35+
}
36+
}

0 commit comments

Comments
 (0)